[Flow-tools] Using flow-fanout with different interfaces

[Zemke, Kai]

Hi,

 

i have created a scenario in which i receive the netflow streams from three different routers. These three streams reach my system all on the same interface. On this interface the streams get caught by flow-fanout and I distribute them to the loopback interface on two difeerent ports. This is working great so far. 

 

But I Added a new interface to the system on which I wanted to receive streams for testing. Via tcpdump I can see packages reaching this interface on the correct port. But when I try to distribute this stream via flow-fanout, nothing happens. The stream unlike the others is not duplicated to the two ports on the loopback interface.

 

Flow-fanout is called like this for the working interface

flow-fanout hostadress/exporteraddress/9600 0/0/9610 0/0/9620

flow-fanout hostadress/exporteraddress/9700 0/0/9710 0/0/9720

flow-fanout hostadress/exporteraddress/9800 0/0/9810 0/0/9820

 

For the not working interface I called it like this:

flow-fanout 10.1.1.121/exporteradress/9900 0/0/9910

 

I don't understand why the last example doesn't work. Anyone who can give me a hint what I am doing wrong or knows that I make mistake here? Any help is highly appreciated.

 

Mit freundlichen Grüßen

Kai Zemke

 

=========================================================== 
smartnet Online Service GmbH, Schnackenburgallee 177, 22525 Hamburg 
=========================================================== 
Geschäftsführer: Christian Suding, Claus Masch 
Ust.IdNr.:DE191136350
Handelsregister HRB 66463 
Steuernummer: FA: Hamburg 54/855/01047
Fon: +49 (0) 40 5540-0
Fax: +49 (0) 40 5540-1040
kai.zemke at smartnet.de
Weitere Informationen siehe: http://www.smartnet.de <http://www.smartnet.de/> 
===========================================================  

 

Hinweis:
Diese Email kann vertrauliche und/oder rechtlich geschützte 
Informationen enthalten. Wenn Sie nicht der beabsichtigte  
Empfänger sind oder diese Email irrtümlich erhalten haben, 
informieren Sie bitte sofort den Absender telefonisch oder 
per Email und löschen Sie diese Email aus Ihrem System. 
Das unerlaubte Kopieren, sowie die unbefugte Weitergabe 
dieser Email ist nicht gestattet.Wir haften nicht für die 
Unversehrtheit von Emails, nachdem sie unseren Einfluss-
Bereich verlassen haben.

 

**********************************************************************************************
IMPORTANT: The contents of this email and any attachments are confidential. They are intended for the 
named recipient(s) only.
If you have received this email in error, please notify the system manager or the sender immediately and do 
not disclose the contents to anyone or make copies thereof.
*** eSafe scanned this email for viruses, vandals, and malicious content. ***
**********************************************************************************************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.splintered.net/pipermail/flow-tools/attachments/20090106/3a17a1a6/attachment.htm